sdlc-orchestrator/coder/cloudflare-worker/main.tf

771 lines
20 KiB
HCL

# =============================================================================
# Cloudflare Worker Development - Coder Template
# =============================================================================
# Lightweight workspace for Cloudflare Workers with Hono, Drizzle, and
# Claude Code automation. Supports automated SDLC via n8n triggers.
# =============================================================================
terraform {
required_providers {
coder = {
source = "coder/coder"
}
kubernetes = {
source = "hashicorp/kubernetes"
}
}
}
# =============================================================================
# Data Sources
# =============================================================================
data "coder_workspace" "me" {}
data "coder_workspace_owner" "me" {}
data "coder_provisioner" "me" {}
data "coder_external_auth" "github" {
id = "primary-github"
}
# =============================================================================
# Parameters
# =============================================================================
data "coder_parameter" "cpu" {
name = "cpu"
display_name = "CPU Cores"
description = "Number of CPU cores"
type = "number"
default = "2"
mutable = false
option {
name = "1 Core"
value = "1"
}
option {
name = "2 Cores"
value = "2"
}
option {
name = "4 Cores"
value = "4"
}
}
data "coder_parameter" "memory" {
name = "memory"
display_name = "Memory (MB)"
description = "Amount of memory"
type = "number"
default = "4096"
mutable = false
option {
name = "2048 MB"
value = "2048"
}
option {
name = "4096 MB"
value = "4096"
}
option {
name = "8192 MB"
value = "8192"
}
}
data "coder_parameter" "disk_size" {
name = "disk_size"
display_name = "Disk Size (GB)"
description = "Persistent home directory size"
type = "number"
default = "10"
mutable = false
option {
name = "5 GB"
value = "5"
}
option {
name = "10 GB"
value = "10"
}
option {
name = "20 GB"
value = "20"
}
}
# ─── Automation Parameters ───────────────────────────────────────────────────
data "coder_parameter" "repo_clone_url" {
name = "repo_clone_url"
display_name = "Repository Clone URL"
description = "Git repo URL to clone (leave empty for manual setup)"
type = "string"
default = ""
mutable = false
}
data "coder_parameter" "task_type" {
name = "task_type"
display_name = "Task Type"
description = "Claude Code command to run automatically (leave empty for interactive use)"
type = "string"
default = ""
mutable = false
option {
name = "None (interactive)"
value = ""
}
option {
name = "Analyse"
value = "analyse"
}
option {
name = "Architect"
value = "architect"
}
option {
name = "Develop"
value = "develop"
}
option {
name = "Review Code"
value = "review-code"
}
option {
name = "Test"
value = "test"
}
option {
name = "Fix Bug"
value = "fix-bug"
}
option {
name = "Rework PR"
value = "rework-pr"
}
option {
name = "Release"
value = "release"
}
option {
name = "DevOps"
value = "devops"
}
option {
name = "Create Migration"
value = "create-migration"
}
}
data "coder_parameter" "issue_number" {
name = "issue_number"
display_name = "Issue/PR Number"
description = "Gitea issue or PR number (for automated tasks)"
type = "string"
default = ""
mutable = false
}
data "coder_parameter" "gitea_token" {
name = "gitea_token"
display_name = "Gitea API Token"
description = "API token for reading issues and posting comments"
type = "string"
default = ""
mutable = false
}
data "coder_parameter" "gitea_org" {
name = "gitea_org"
display_name = "Gitea Organization"
description = "Gitea organization name"
type = "string"
default = "claude"
mutable = false
}
data "coder_parameter" "gitea_repo" {
name = "gitea_repo"
display_name = "Gitea Repository"
description = "Gitea repository name"
type = "string"
default = ""
mutable = false
}
data "coder_parameter" "anthropic_api_key" {
name = "anthropic_api_key"
display_name = "Anthropic API Key"
description = "API key for Claude Code"
type = "string"
default = ""
mutable = false
}
data "coder_parameter" "callback_url" {
name = "callback_url"
display_name = "Task Complete Callback URL"
description = "URL to POST when task finishes (set by orchestrator)"
type = "string"
default = ""
mutable = false
}
data "coder_parameter" "deploy_env" {
name = "deploy_env"
display_name = "Deploy Environment"
description = "Target environment for deploy tasks"
type = "string"
default = ""
mutable = false
option {
name = "None"
value = ""
}
option {
name = "Staging"
value = "staging"
}
option {
name = "Production"
value = "production"
}
}
# =============================================================================
# Locals
# =============================================================================
locals {
namespace = "coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}"
labels = {
"app.kubernetes.io/name" = "coder-workspace"
"app.kubernetes.io/instance" = data.coder_workspace.me.name
"app.kubernetes.io/managed-by" = "coder"
"coder.workspace.owner" = data.coder_workspace_owner.me.name
}
}
# =============================================================================
# Namespace
# =============================================================================
resource "kubernetes_namespace_v1" "workspace" {
metadata {
name = local.namespace
labels = local.labels
annotations = {
"field.cattle.io/projectId" = "local:p-w2w48"
}
}
}
# =============================================================================
# Secrets - Registry Access
# =============================================================================
data "kubernetes_secret_v1" "registry_source" {
metadata {
name = "registry-samson-media"
namespace = "registry"
}
}
resource "kubernetes_secret_v1" "registry" {
metadata {
name = "registry-samson-media"
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
labels = local.labels
}
type = "kubernetes.io/dockerconfigjson"
data = {
".dockerconfigjson" = data.kubernetes_secret_v1.registry_source.data[".dockerconfigjson"]
}
}
# =============================================================================
# RBAC
# =============================================================================
resource "kubernetes_service_account_v1" "workspace" {
metadata {
name = "workspace"
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
labels = local.labels
}
}
resource "kubernetes_role_v1" "workspace" {
metadata {
name = "workspace-admin"
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
labels = local.labels
}
rule {
api_groups = ["", "apps", "batch", "networking.k8s.io"]
resources = ["*"]
verbs = ["*"]
}
}
resource "kubernetes_role_binding_v1" "workspace" {
metadata {
name = "workspace-admin"
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
labels = local.labels
}
role_ref {
api_group = "rbac.authorization.k8s.io"
kind = "Role"
name = kubernetes_role_v1.workspace.metadata[0].name
}
subject {
kind = "ServiceAccount"
name = kubernetes_service_account_v1.workspace.metadata[0].name
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
}
}
resource "kubernetes_role_binding_v1" "rancher_user_access" {
metadata {
name = "rancher-user-access"
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
labels = local.labels
}
role_ref {
api_group = "rbac.authorization.k8s.io"
kind = "ClusterRole"
name = "coder-developer"
}
subject {
api_group = "rbac.authorization.k8s.io"
kind = "User"
name = data.coder_workspace_owner.me.name
}
}
# =============================================================================
# Resource Quotas
# =============================================================================
resource "kubernetes_resource_quota_v1" "workspace" {
metadata {
name = "workspace-quota"
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
labels = local.labels
}
spec {
hard = {
"requests.cpu" = "${tonumber(data.coder_parameter.cpu.value) * 500}m"
"limits.cpu" = "${tonumber(data.coder_parameter.cpu.value) * 1000}m"
"requests.memory" = "${tonumber(data.coder_parameter.memory.value) / 2}Mi"
"limits.memory" = "${data.coder_parameter.memory.value}Mi"
"requests.storage" = "${data.coder_parameter.disk_size.value}Gi"
"persistentvolumeclaims" = "1"
}
}
}
# =============================================================================
# Storage
# =============================================================================
resource "kubernetes_persistent_volume_claim_v1" "home" {
metadata {
name = "home"
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
labels = local.labels
}
wait_until_bound = false
spec {
access_modes = ["ReadWriteOnce"]
storage_class_name = "longhorn-backup"
resources {
requests = {
storage = "${data.coder_parameter.disk_size.value}Gi"
}
}
}
}
# =============================================================================
# Coder Agent
# =============================================================================
resource "coder_agent" "main" {
arch = data.coder_provisioner.me.arch
os = "linux"
dir = "/home/coder"
startup_script_behavior = "non-blocking"
# Configure auto-stop TTL in Coder template settings:
# Settings > Auto-stop > Default TTL: 1 hour
# This ensures automated workspaces don't run indefinitely.
metadata {
display_name = "Task Type"
key = "task_type"
script = "echo $TASK_TYPE"
interval = 0
}
metadata {
display_name = "Issue Number"
key = "issue_number"
script = "echo $ISSUE_NUMBER"
interval = 0
}
display_apps {
vscode = true
vscode_insiders = false
ssh_helper = true
port_forwarding_helper = true
web_terminal = true
}
metadata {
display_name = "Task Status"
key = "task_status"
script = <<-EOS
if [ -f ~/task-output.log ]; then
if grep -q "Task completed" ~/task-output.log 2>/dev/null; then
echo "✅ Complete"
else
echo "⏳ Running ($(wc -l < ~/task-output.log) lines)"
fi
elif [ -n "$TASK_TYPE" ]; then
echo "⏳ Starting..."
else
echo "Interactive"
fi
EOS
interval = 10
}
env = {
ANTHROPIC_API_KEY = data.coder_parameter.anthropic_api_key.value
GITHUB_TOKEN = data.coder_external_auth.github.access_token
GITEA_TOKEN = data.coder_parameter.gitea_token.value
GITEA_ORG = data.coder_parameter.gitea_org.value
GITEA_REPO = data.coder_parameter.gitea_repo.value
TASK_TYPE = data.coder_parameter.task_type.value
ISSUE_NUMBER = data.coder_parameter.issue_number.value
REPO_CLONE_URL = data.coder_parameter.repo_clone_url.value
DEPLOY_ENV = data.coder_parameter.deploy_env.value
CALLBACK_URL = data.coder_parameter.callback_url.value
}
startup_script = <<-EOT
#!/bin/bash
set -e
# --- Configure git ---
git config --global user.name "${data.coder_workspace_owner.me.full_name}"
git config --global user.email "${data.coder_workspace_owner.me.email}"
# Configure git to use GITEA_TOKEN for HTTPS push/pull
if [ -n "$GITEA_TOKEN" ]; then
git config --global credential.helper 'store'
echo "https://oauth2:$GITEA_TOKEN@gitea.samson.media" > ~/.git-credentials
chmod 600 ~/.git-credentials
fi
# --- Clone repository ---
if [ -n "$REPO_CLONE_URL" ] && [ ! -d ~/project ]; then
git clone "$REPO_CLONE_URL" ~/project
cd ~/project
# Switch to develop branch if it exists
git fetch origin develop 2>/dev/null && git checkout develop 2>/dev/null || true
# Install backend deps
npm ci --legacy-peer-deps
# Install frontend deps
cd frontend && npm ci && cd ..
# Build frontend (required — vitest fails without frontend/dist)
npm run build:frontend
# Install Playwright Chromium
npx playwright install chromium
# Apply local migrations
npm run db:migrate:local
fi
# --- Start log viewer on port 13338 ---
if [ -n "$TASK_TYPE" ]; then
touch ~/task-output.log
cat > ~/log-server.sh << 'LOGEOF'
#!/bin/bash
while true; do
{
echo "HTTP/1.1 200 OK"
echo "Content-Type: text/html; charset=utf-8"
echo "Connection: close"
echo ""
echo "<html><head><title>Task Log</title>"
echo "<meta http-equiv='refresh' content='5'>"
echo "<style>body{background:#1e1e1e;color:#d4d4d4;font-family:monospace;font-size:13px;padding:16px;white-space:pre-wrap;}"
echo "h2{color:#569cd6;margin:0 0 8px}.meta{color:#6a9955;margin-bottom:16px;display:block}</style></head><body>"
echo "<h2>$TASK_TYPE #$ISSUE_NUMBER — $(hostname)</h2>"
if [ -f ~/task-output.log ]; then
LINES=$(wc -l < ~/task-output.log)
if grep -q "Task completed" ~/task-output.log 2>/dev/null; then
echo "<span class='meta'>Status: Complete ($LINES lines)</span>"
else
echo "<span class='meta'>Status: Running ($LINES lines) auto-refreshing every 5s</span>"
fi
sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g' ~/task-output.log
else
echo "Waiting for task to start..."
fi
echo "</body></html>"
} | nc -l -p 13338 -q 1 2>/dev/null || true
done
LOGEOF
chmod +x ~/log-server.sh
nohup bash ~/log-server.sh &>/dev/null &
fi
# --- Automated task execution ---
if [ -n "$TASK_TYPE" ] && [ -d ~/project ]; then
cd ~/project
ARGS="$ISSUE_NUMBER"
if [ "$TASK_TYPE" = "devops" ] && [ -n "$DEPLOY_ENV" ]; then
ARGS="$DEPLOY_ENV"
fi
# Read the slash command .md file, strip YAML frontmatter, substitute $ARGUMENTS
CMD_FILE=".claude/commands/$TASK_TYPE.md"
if [ ! -f "$CMD_FILE" ]; then
echo "ERROR: Command file not found: $CMD_FILE" | tee ~/task-output.log
exit 1
fi
PROMPT=$(sed '1{/^---$/!q}; 1,/^---$/d' "$CMD_FILE" | sed "s/\\\$ARGUMENTS/$ARGS/g")
# Run Claude Code in non-interactive mode with tool access
claude -p --dangerously-skip-permissions --verbose "$PROMPT" 2>&1 | tee ~/task-output.log
EXIT_CODE=$?
echo "Claude exited with code: $EXIT_CODE" | tee -a ~/task-output.log
echo "Task completed. Output saved to ~/task-output.log"
# Notify orchestrator that the task is done
if [ -n "$CALLBACK_URL" ]; then
curl -s -X POST -H "Content-Type: application/json" \
-d '{"status":"complete"}' \
"$CALLBACK_URL" || echo "Callback failed (non-fatal)"
fi
fi
EOT
}
resource "coder_app" "task_log" {
agent_id = coder_agent.main.id
slug = "task-log"
display_name = "Task Log"
icon = "/icon/document.svg"
url = "http://localhost:13338"
share = "owner"
healthcheck {
url = "http://localhost:13338"
interval = 10
threshold = 3
}
}
# =============================================================================
# Main Workspace Deployment
# =============================================================================
resource "kubernetes_deployment_v1" "workspace" {
metadata {
name = "workspace"
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
labels = local.labels
}
wait_for_rollout = false
spec {
replicas = data.coder_workspace.me.start_count
strategy {
type = "Recreate"
}
selector {
match_labels = {
app = "workspace"
}
}
template {
metadata {
labels = merge(local.labels, {
app = "workspace"
})
}
spec {
service_account_name = kubernetes_service_account_v1.workspace.metadata[0].name
security_context {
run_as_user = 1000
run_as_group = 1000
fs_group = 1000
}
image_pull_secrets {
name = kubernetes_secret_v1.registry.metadata[0].name
}
init_container {
name = "fix-permissions"
image = "busybox:latest"
command = ["sh", "-c", <<-EOC
if [ ! -d /home/coder/project ]; then
mkdir -p /home/coder/project
fi
chown -R 1000:1000 /home/coder
EOC
]
volume_mount {
name = "home"
mount_path = "/home/coder"
}
resources {
requests = {
cpu = "5m"
memory = "8Mi"
}
limits = {
cpu = "50m"
memory = "32Mi"
}
}
security_context {
run_as_user = 0
}
}
container {
name = "coder-agent"
image = "registry.samson.media/coder-workspace:latest"
command = ["sh", "-c", coder_agent.main.init_script]
env {
name = "CODER_AGENT_TOKEN"
value = coder_agent.main.token
}
env {
name = "ANTHROPIC_API_KEY"
value = data.coder_parameter.anthropic_api_key.value
}
env {
name = "GITHUB_TOKEN"
value = data.coder_external_auth.github.access_token
}
env {
name = "GITEA_TOKEN"
value = data.coder_parameter.gitea_token.value
}
env {
name = "GITEA_ORG"
value = data.coder_parameter.gitea_org.value
}
env {
name = "GITEA_REPO"
value = data.coder_parameter.gitea_repo.value
}
env {
name = "TASK_TYPE"
value = data.coder_parameter.task_type.value
}
env {
name = "ISSUE_NUMBER"
value = data.coder_parameter.issue_number.value
}
env {
name = "REPO_CLONE_URL"
value = data.coder_parameter.repo_clone_url.value
}
env {
name = "DEPLOY_ENV"
value = data.coder_parameter.deploy_env.value
}
env {
name = "CALLBACK_URL"
value = data.coder_parameter.callback_url.value
}
resources {
requests = {
cpu = "${tonumber(data.coder_parameter.cpu.value) * 500}m"
memory = "${tonumber(data.coder_parameter.memory.value) / 2}Mi"
}
limits = {
cpu = "${tonumber(data.coder_parameter.cpu.value) * 1000}m"
memory = "${data.coder_parameter.memory.value}Mi"
}
}
volume_mount {
name = "home"
mount_path = "/home/coder"
}
security_context {
run_as_user = 1000
run_as_group = 1000
}
}
volume {
name = "home"
persistent_volume_claim {
claim_name = kubernetes_persistent_volume_claim_v1.home.metadata[0].name
}
}
}
}
}
}